Cisco ASA Access Control List ICMP Echo Request Code Filtering Vulnerability (cisco-sa-20160711-asa)——漏洞银行丨0DAY BANK

A vulnerability in the Cisco Adaptive Security Appliance (ASA) Software implementation of access control list (ACL) permit and deny filters for ICMP Echo Reply messages could allow an unauthenticated, remote attacker to bypass ACL configurations for an affected device. ICMP traffic that should be denied may instead be allowed through an affected device.

The vulnerability is due to the implementation of ACL-based filters for ICMP Echo Requests and the range of ICMP Echo Request subtypes.

An attacker could exploit this vulnerability by sending ICMP Echo Request traffic to an affected device. A successful exploit could allow the attacker to bypass ACL configurations for the device, which could allow traffic that should be denied to instead be allowed through the device.

Refer to Cisco ASA advisory cisco-sa-20160711-asa for updates and patch information.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

cisco-sa-20160711-asa: Cisco ASA